Zero Trust Architecture – Foundations and Transition Paths

March 2018 · Reading time: 13 mins

Introduction

In 2018, enterprises move beyond perimeter-based security. Traditional firewalls and VPNs fall short in protecting mobile users, cloud-hosted applications, and internal threats. Zero Trust Architecture (ZTA) emerges as a new model that eliminates implicit trust and verifies access continuously based on context and risk.

What Zero Trust Means

Zero Trust assumes that no user or device deserves automatic trust—whether inside or outside the network. Instead, organizations enforce policies based on user identity, device health, role, location, and behavior. This context-aware approach allows granular access control and reduces the risk of lateral movement.

Why Enterprises Adopt Zero Trust

• Cloud-first workstyles: Users access resources from anywhere, bypassing traditional firewalls
• Credential compromise: Attackers steal logins and operate undetected in trusted zones
• Compliance pressure: Frameworks like GDPR and NIST demand continuous access validation
• IoT and APIs: Non-user entities require policy enforcement too

Core Components of ZTA

• Identity Provider (IdP): Authenticates users and devices
• Policy Engine: Evaluates signals and grants conditional access
• Access Proxy or Broker: Enforces decisions in real-time at session establishment
• Device Posture Checks: Validates OS, patch level, antivirus, and encryption
• Segmentation: Prevents access beyond what's necessary

How Organizations Begin

Zero Trust requires more than a product—it requires staged transformation:

1. Map users, devices, and data flows
2. Classify applications by risk and criticality
3. Apply MFA and identity brokering across access points
4. Insert proxies to control and inspect traffic
5. Log and audit every access decision

Example: Migrating from VPN to ZTNA

A healthcare organization replaces legacy VPN with a cloud-native ZTNA platform. Staff authenticate via SSO, and access brokers validate device health and user role before granting access to patient records or scheduling apps. The result: improved security posture and better user experience with reduced exposure.

Tooling and Ecosystem in 2018

Vendors like Okta, Duo Security, Zscaler, and Palo Alto Networks provide policy engines, SSO integrations, and access brokers. Open-source solutions like SPIFFE help assign identities to workloads and secure east-west traffic in microservice environments. APIs allow organizations to integrate with SIEMs and enforce dynamic rules across SaaS and IaaS.

Challenges to Anticipate

• Policy sprawl: Overly complex policies create usability issues
• Performance impact: Brokers and tunnels may affect latency
• Stakeholder resistance: IT teams must align security with business outcomes
• Cultural shift: Security becomes continuous, not checkpoint-based

Conclusion

By March 2018, Zero Trust moves from buzzword to implementation. Enterprises begin building context-aware security controls, gradually phasing out static, perimeter-centric models. We'll explore microsegmentation and continuous verification as essential steps in the Zero Trust journey in another posts.

Eduardo Wnorowski is a network infrastructure consultant and Director.
With over 23 years of experience in IT and consulting, he helps organizations maintain stable and secure environments through proactive auditing, optimization, and strategic guidance.
LinkedIn Profile